Security · High impactFan score 69 · Tier A5 sources
Barracuda’s email security gateways bitten by make-me-root vulns
The Register · By Jessica Lyons ·
The Brief · written from 5 sources
- Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities.
- The flaws let attackers run commands with root privileges on affected appliances.
- Barracuda describes the flaws as critical, and the attacks are active.
Why it matters
Attackers with root access on an email security gateway could control mail traffic and reach systems behind it. Organizations running affected ESG versions should treat this as an active compromise risk.
Who’s affected
- Organizations running Barracuda Email Security Gateway
What to do
- Apply Barracuda's patches for the two recently fixed ESG vulnerabilities.
- #email-security
- #vulnerability
- #exploitation
- #privilege-escalation
- #barracuda
Security company Barracuda warns that attackers are exploiting a pre-authentication authorization bypass bug and a command-injection vulnerability in its popular Email Security Gateway (ESG) products that, when chained, could allow the crims to run commands with root privileges…
Timeline
SecurityWeek
Barracuda ESG Authentication Bypass Flaw Opens Path to Root
watchTowr Labs
Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)
The Hacker News
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
Barracuda warns that attackers have begun exploiting two patched ESG vulnerabilities
BleepingComputer
Hackers now exploit critical Barracuda ESG flaws to gain root access
www.theregister.com - Articles
Barracuda’s email security gateways bitten by make-me-root vulns